Техническая информация
Вредоносные функции:
Запускает себя в качестве демона
Подменяет имя приложения на:
- rpcbind
Выполняет операции с файловой системой:
Создает или модифицирует файлы:
- /self
- /proc/508/cmdline
Сетевая активность:
Ожидает входящих соединений на портах:
- 0.0.0.0:51925
Устанавливает соединение:
- 8.#.8.8:53
- 17#.##.210.240:51925
Проводит атаку перебором по словарю (брутфорс) по протоколу Telnet.
Посылает данные следующим серверам:
- 14#.##9.180.101:23
- 17.###.42.147:23
- 12#.##7.216.72:23
- 19#.#6.85.99:23
- 12#.##6.241.188:23
- 74.###.128.215:23
- 95.###.149.153:23
- 17#.##.224.227:23
- 12#.#.93.139:23
- 98.##8.1.186:23
- 20#.##.95.179:23
- 18#.##2.205.130:23
- 50.###.162.110:23
- 21#.##5.197.72:23
- 67.###.210.131:23
- 17.###.199.91:23
- 15#.##.179.86:23
- 89.###.69.230:23
- 17#.#4.99.44:23
- 80.##.247.168:23
- 87.###.174.124:23
- 18#.##5.55.61:23
- 14#.##.181.85:23
- 13#.##.95.137:23
- 27.##9.3.87:23
- 45.##.213.192:23
- 85.###.243.241:23
- 17#.##0.91.221:23
- 39.#.200.74:23
- 11#.##.115.53:23
- 4.###.7.95:23
- 88.###.45.248:23
- 15#.##.173.113:23
- 10#.##7.139.40:23
- 48.###.242.12:23
- 16#.##.34.167:23
- 15#.#3.16.63:23
- 16#.##4.219.23:23
- 15#.##3.218.52:23
- 59.###.44.112:23
- 59.###.242.224:23
- 16#.#.222.72:23
- 82.###.218.227:23
- 2.##.74.99:23
- 12#.##5.132.54:23
- 13#.#5.10.44:23
- 35.##.0.213:23
- 54.##.194.45:23
- 48.###.164.178:23
- 13#.##.74.143:23
- 78.##.145.115:23
- 13#.##2.254.217:23
- 66.###.210.27:23
- 73.#.42.36:23
- 9.##.249.105:23
- 20#.#.238.241:23
- 11#.##6.222.22:23
- 95.##.85.98:23
- 21#.#8.73.0:23
- 31.###.86.247:23
- 20#.##4.187.146:23
- 11#.##.73.217:23
- 19#.#7.44.36:23
- 97.###.195.64:23
- 17#.##.91.144:23
- 89.###.54.177:23
- 21#.#.183.147:23
- 32.#.235.222:23
- 80.###.184.85:23
- 91.##.53.155:23
- 61.###.232.96:23
- 54.###.218.144:23
- 44.###.221.171:23
- 15#.##0.187.116:23
- 19#.##7.205.225:23
- 16#.##7.162.119:23
- 11#.##4.39.175:23
- 15#.##.175.209:23
- 13#.##6.250.90:23
- 88.##.199.26:23
- 11#.##.143.233:23
- 16#.##0.140.125:23
- 20#.##0.70.189:23
- 96.##.167.97:23
- 76.##.76.114:23
- 77.###.145.165:23
- 51.###.102.207:23
- 11#.##.72.100:23
- 20#.##.207.46:23
- 92.###.206.197:23
- 17#.##.86.210:23
- 97.###.96.168:23
- 16#.#3.2.195:23
- 10#.##1.206.221:23
- 27.##.222.3:23
- 14#.##4.214.79:23
- 92.###.239.170:23
- 18#.#.81.202:23
- 94.###.97.250:23
- 48.##4.70.54:23
- 90.###.155.25:23
- 15#.##.171.245:23
- 20#.##.235.196:23
- 11#.##.228.28:23
- 99.##.206.132:23
- 16#.#7.49.32:23
- 9.##.181.59:23
- 16#.##8.212.96:23
- 31.###.208.68:23
- 13#.##5.10.112:23
- 12#.##.88.148:23
- 11#.##4.24.123:23
- 5.###.31.87:23
- 10#.##5.190.42:23
- 12#.##.114.56:23
- 49.###.152.109:23
- 18#.#1.22.85:23
- 19#.##3.205.13:23
- 40.###.118.25:23
- 80.##8.2.49:23
- 72.###.179.71:23
- 37.##.163.145:23
- 12#.##.116.142:23
- 20#.##.228.251:23
- 15#.#74.11.9:23
- 62.###.15.122:23
- 20#.##4.165.140:23
- 13#.##.218.152:23
- 18#.##.197.121:23
- 1.###.234.18:23
- 15#.#6.63.58:23
- 87.##.227.26:23
- 99.##.175.20:23
- 17#.##8.177.25:23
- 92.##.72.169:23
- 52.##4.233.1:23
- 10#.##6.11.234:23
- 14#.##.50.199:23
- 14#.##6.240.101:23
- 10#.##6.117.181:23
- 13.#.200.196:23
- 12#.##8.232.177:23
- 14#.##.142.183:23
- 86.###.25.111:23
- 19#.##.118.130:23
- 11#.##.134.232:23
- 14#.##.166.139:23
- 19#.#.20.1:23
- 21#.##5.175.21:23
- 19#.##.31.192:23
- 14#.##5.84.30:23
- 90.##.38.219:23
- 10#.##.228.29:23
- 10#.##2.212.181:23
- 25.##.22.147:23
- 87.##0.44.40:23
- 90.###.13.203:23
- 61.###.51.203:23
- 63.###.233.224:23
- 10#.##1.167.61:23
- 1.##.94.146:23
- 79.###.65.175:23
- 16#.##4.242.7:23
- 13#.##9.236.219:23
- 18#.##3.39.74:23
- 17#.##.100.61:23
- 20#.##4.91.175:23
- 11#.##4.92.254:23
- 19#.##9.81.97:23
- 19#.##8.138.68:23
- 13#.##.117.200:23
- 19#.##9.121.101:23
- 17#.##8.146.140:23
- 11#.##0.48.98:23
- 18.###.131.31:23
- 17#.##7.56.125:23
- 5.###.52.207:23
- 41.##.249.189:23
- 21#.#5.18.34:23
- 17#.##4.117.33:23
- 77.###.205.220:23
- 25.##9.1.176:23
- 90.###.230.184:23
- 10#.##.25.231:23
- 19#.##1.23.52:23
- 21#.#6.125.0:23
- 16#.#6.98.83:23
- 19#.##.139.146:23
- 72.##.248.105:23
- 90.###.227.237:23
- 19#.#13.80.6:23
- 10#.##4.136.57:23
- 93.##.161.204:23
- 12#.##6.44.97:23
- 20#.##3.238.134:23
- 15#.#.69.70:23
- 14#.##3.121.171:23
- 18#.##8.109.11:23
- 14#.##9.124.204:23
- 14.##4.57.42:23
- 98.#.87.66:23
- 17#.##4.117.137:23
- 60.###.209.194:23
- 97.##.65.180:23
- 19#.#9.64.22:23
- 11#.##3.17.54:23
- 13#.##9.142.236:23
- 25.##.13.229:23
- 21#.##.72.211:23
- 5.###.36.67:23
- 65.##.55.111:23
- 18.##.29.88:23
- 13#.##1.183.238:23
- 31.###.202.231:23
- 12.###.136.109:23
- 58.##3.5.129:23
- 13#.##0.57.25:23
- 19#.##.114.48:23
- 14#.##3.136.230:23
- 44.###.241.190:23
- 14#.##.103.224:23
- 13#.##0.232.36:23
- 11#.##4.164.102:23
- 20#.##.35.144:23
- 47.##6.13.92:23
- 17#.##0.218.1:23
- 14#.##9.216.71:23
- 10#.##.153.116:23
- 15#.##4.226.78:23
- 15#.#.196.153:23
- 21#.##.244.38:23
- 14#.##4.69.137:23
- 97.###.189.153:23
- 10#.##4.157.45:23
- 19.###.212.101:23
- 20#.##2.121.23:23
- 20#.#.190.75:23
- 84.###.120.100:23
- 18#.##8.248.220:23
- 13#.##1.138.33:23
- 46.##3.98.14:23
- 11#.##8.60.13:23
- 10#.##8.184.222:23
- 95.##.206.5:23
- 12#.##2.96.47:23
- 86.###.98.107:23
- 59.##.168.124:23
- 16#.##3.105.143:23
- 58.##.229.92:23
- 5.###.16.136:23
- 4.##.44.83:23
- 53.##.168.98:23
- 20#.##7.84.247:23
- 22#.##.51.107:23
- 86.###.101.101:23
- 13#.##0.44.61:23
- 15#.##.218.232:23
- 20#.##.117.45:23
- 19.#.73.196:23
Прочее:
Читает информацию из /proc/kallsyms
